export interface FrontendSafetyOptions {
    /** Dependency mutations stay denied unless the extension host opts in. */
    allowDependencyInstall?: boolean;
}
export interface ToolCallLike {
    toolName: string;
    input: Record<string, unknown>;
}
export interface SafetyDecision {
    allowed: boolean;
    code?: "dependency-mutation" | "outside-write" | "sensitive-path";
    reason?: string;
}
/** Resolves existing symlink ancestors so an in-workspace link cannot escape the cwd. */
export declare function isPathWithinWorkspace(cwd: string, candidate: string): boolean;
export declare function isSensitivePath(candidate: string): boolean;
export declare function isDependencyMutationCommand(command: string, cwd?: string): boolean;
/**
 * Extracts targets for common shell mutations. It is deliberately conservative:
 * unknown dynamic targets are represented by no path and remain visible as a
 * workspace-level dirty marker after the command succeeds.
 */
export declare function extractShellWriteTargets(command: string): string[];
export declare function evaluateToolCallSafety(event: ToolCallLike, cwd: string, options?: FrontendSafetyOptions): SafetyDecision;
export declare function detectDirtyFiles(event: ToolCallLike, cwd: string): string[];
//# sourceMappingURL=safety.d.ts.map